Threats affecting pkg:pypi/apache-airflow-providers-apache-kafka

Apache Airflow Apache Kafka provider versions 1.15.0 up to but not including 2.0.0 contain a vulnerability where externally controlled input in a Kafka connection's extra field is unsafely reflected and executed. This allows users with permission to edit Airflow connections to achieve arbitrary code execution in the scheduler process if Kafka event producers are enabled. The vulnerability is mitigated in version 2.0.0 and later by introducing an allowlist for connection-string callbacks. Deployments using Google Managed Kafka are not affected.